9dc0c7070bc8f96ea42a36a02dd477d86308c1465a8af201d4935bda8eaf3788

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 03:39

Target

669a568a130c0fb05a26126d1a50f726.dll
Size

76KB
MD5

669a568a130c0fb05a26126d1a50f726
SHA1

ccf9cc826d156b0edbd5162ed83cc649dc50115b
SHA256

9dc0c7070bc8f96ea42a36a02dd477d86308c1465a8af201d4935bda8eaf3788
SHA512

534777157ba9568a87dcc59131f8b7345c213a829948bbb7a0d887b26495b10fabfdb3ef717499db9cda66f3accdb77e0a54c040c832cd9c4c2d97cbdeafaf8c
SSDEEP

768:OyYc0E7Yvz24EBhOY19bgCg601yq7Dh9mtDx1ySAqBctdjYTR57BxBIYrhKOoOCH:OJBvgn19vcDh9mtDwkcrGR5zE9Z80La

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1716	2324	rundll32.exe	86
PID 2324 wrote to memory of 1716	2324	rundll32.exe	86
PID 2324 wrote to memory of 1716	2324	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\669a568a130c0fb05a26126d1a50f726.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\669a568a130c0fb05a26126d1a50f726.dll,#1
  2⤵
  PID:1716

memory/1716-0-0x0000000000560000-0x0000000000569000-memory.dmp

Filesize
36KB

Download